Hello Community!
This has been a quiet week in terms of Sonar announcements, which, given the pace at which tech moves these days, might not be that bad! With nothing new and flashy to announce, we can take this as a week of reflection. Reflect, for example, on how far Gitar has come in the past few weeks, or reflect about how far you have come in this past year by taking out developer survey! Okay, this segue might have ended up a bit too cheesy, but you know I had to try 
So now, like every week, we’d like to take a moment to recognize you, the users, who help improve the ecosystem for everyone by sparking valuable discussions and providing feedback to drive continuous improvement in our products.
SonarQube Cloud
Pull request analysis results went missing on SonarQube Cloud on September 24, even though scans were completing successfully behind the scenes! 
This was quite the hiccup, but thanks to reports from @Chalks, @NeilWh, @JANA-melino, @timothypace, @ChrisDiLorenzo, @JFCote, @dhuang, @williamg2703, and @Arne_De_Herdt, who flagged it as it happened, we tracked the issue down and rolled out a fix. If your pull request was affected before the fix landed, push a new commit or rerun the analysis to regenerate the results.
Scanners
Reusable GitHub Actions scripts (PowerShell, Python, YAML, Bicep) living under .github/ were silently skipped by language analyzers on SonarQube Cloud, since hidden folders are opt-in per analyzer and only secrets scanning and GitHub Actions analysis cover .github by default. Thanks @mortenbgo for raising it! We’ve already implemented picking up .github by default, and it’ll roll out with upcoming releases.
Rules & Languages
java:S6832 flagged proxied non-singleton beans as noncompliant even when injecting a differently-scoped bean into a singleton via ScopedProxyMode.TARGET_CLASS, which is the recommended Spring pattern. @Dirk_Gabler flagged the false positive, and @arey joined the cause. You’re both right, this has been fixed and the false positive should disappear with SONARJAVA-6256.
When you add the @Deprecated annotation to an existing method, java:S1123 places the issue on the method signature rather than on the annotation itself, so PR analysis never catches it. @Travis_Pennetti connected this to our public roadmap and a similar 2023 report. We’ll add secondary locations on the @deprecated tag and @Deprecated annotation so the issue lands where the change actually is. Here goes SONARJAVA-7057!
This one gets a bit nerdy 
: CFamily 6.77 failed to resolve size_t, wchar_t, and NULL while parsing Apple’s own SDK headers under Xcode 26.5 / macOS 26.5 with Clang modules enabled, producing over a million diagnostics and leaving a third of functions unparsed. @mwinter-lumivero.com provided a beautifully thorough report that helped narrow this down. The issue has been identified and we’re on it. In the meantime, the workaround is to target an older macOS SDK for the analysis build.
In pnpm workspaces using catalogs, running ESLint from inside a workspace package made eslint-plugin-sonarjs print Dependency "x" could not be resolved for catalog "y" for every catalog dependency, because its search for pnpm-workspace.yaml stopped at the package directory instead of climbing to the workspace root. @daomtthuan delivered a rock-solid write-up, nice catch! We’ll fix this in the next release of the ESLint plugin. JS-2522 was created as a result.
Thanks again to everyone mentioned here - and to anyone we may have missed - for your ongoing contributions in making this community stronger and helping us improve Sonar products.
If you’d like to give a shout-out to someone, whether a community member or a SonarSourcer who helped you, please do so below. And if there’s someone you think we should acknowledge next week, let us know!